Privacy policy

As of: 25.10.2026

1. Controller

Tim Kessler
**********
Email: kessler.tim1@gmail.com

No data protection officer has been appointed; none is required by law.

2. Where the data is kept

Yamis (https://yamis.it) runs on the operator’s own servers in Germany. No third-party hosting, analytics or advertising services are used, no external fonts, scripts or trackers are loaded, and no data is passed on to providers of AI models. Requests to Yamis are processed by language models running on the operator’s computers or – if you set this up – on your own device.

3. What data we process and why

Visiting the website

When you visit, the upstream server (proxy) necessarily processes your IP address, date and time, the requested host name and the amount of data transferred in a connection log. Purpose: operation, security and troubleshooting. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). The log is rotated daily and deleted after 7 days.

Your account

Username, display name, password (only as a secure hash, never in plain text), language setting, time of your last sign-in and the permissions of your account. Purpose: sign-in and providing the service. Legal basis: contract or user relationship (Art. 6(1)(b) GDPR). Kept until the account is deleted.

Conversations, files and results

What you write to or upload for Yamis (texts, files, voice messages), the answers, the agents’ steps and the results they produce, plus whatever Yamis remembers at your request (memory). Purpose: the service itself – Yamis needs the history to keep working. Legal basis: Art. 6(1)(b) GDPR. Kept until you delete the conversation or your account, or have them deleted. Please do not enter special categories of personal data (e.g. health data) or other people’s credentials.

Usage and consumption

Per request: time, model used, number of tokens, computing time and the resulting power consumption. Purpose: showing your usage, limits and operating the service. Legal basis: Art. 6(1)(b) and (f) GDPR. Kept as long as the account exists.

Servers and devices you connect

If you connect your own servers or devices to Yamis, we store their address, user name, the server’s public host key and the results of access checks, and an SSH key of your own (the private part stays with Yamis). Purpose and legal basis as above (Art. 6(1)(b) GDPR). Deleted with the entry or the account.

Waiting list

If you join the waiting list on the start page, we store your email address and – if given – your name, intended use, details about your computer and the time of sign-up. Purpose: sending you an invitation with access details. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by email. The entry is deleted when you withdraw, at the latest six months after the invitation or when the waiting list ends.

Backups

The database is backed up regularly so that nothing is lost in case of an error. Backups are deleted after 14 days. Deleted data may still be contained in a backup until then.

4. Cookies and browser storage

Session cookie – keeps you signed in while the browser is open. Strictly necessary (§ 25(2) TDDDG).
“Keep me signed in” (ymir_remember) – only if you tick the box; keeps you signed in after closing the browser. To remove it: sign out or delete the cookie in your browser.
Light/dark – your display choice in the browser’s local storage; it never leaves your device.
Language (yamis_sprache) – only if you choose a language via the flag; remembers the choice for one year.

There are no cookies for analytics or advertising.

5. Recipients

Your data is not sold and not passed on to third parties. Only the operator has access, as far as needed for operation, security and troubleshooting. If you explicitly share a conversation with other users (tandem), they can see it.

6. Your rights

You have the right to

access your data (Art. 15 GDPR),
rectification (Art. 16), erasure (Art. 17) and restriction of processing (Art. 18),
data portability (Art. 20),
object to processing based on legitimate interests (Art. 21),
withdraw consent with effect for the future (Art. 7(3)).

An informal message to kessler.tim1@gmail.com is enough. You may also lodge a complaint with a data protection supervisory authority; the competent authority is: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach.

7. Obligation to provide data

For an account we need a username and a password; everything else is voluntary. Yamis cannot be used without an account. There is no automated decision-making within the meaning of Art. 22 GDPR.